Generate a cryptographic key
Generates a new cryptographic key for a user. Requires a user identifier and a verification_id that exists in the identity_verifications table and belongs to the user associated with the organisation. This endpoint calls the hot-keys orchestrator partner-assign-key endpoint.
Authorizations
API key for authentication and authorization
Body
User identifier (REQUIRED)
"john.doe@example.com"
Verification ID from a previous verification. (REQUIRED) Must exist in identity_verifications table and belong to the user associated with the organisation.
"a7b8c9d0-e1f2-4345-a678-901234567890"
Optional context fields to bind into the enclave signature. public_key is always signed implicitly and must not be included. Every requested field must resolve to a non-empty value, except key_fingerprint which may resolve after generation. Each field may only be listed once.
external_customer_id, external_package_id, pulled_by_id, pulled_by_type, user_id, key_id, key_fingerprint Response
Key generated successfully
Unique identifier for the generated key (UUID)
"550e8400-e29b-41d4-a716-446655440000"
Public key in hexadecimal format
"30820122300d06092a864886f70d..."
Base64 ECDSA P-256 DER signature. When sign_with is omitted, this signs the bare public_key hex; otherwise it signs signed_payload. Verify it with the verification key CoinCover issued you during integration, not with public_key.
"MEUCIQDxyz123abc456def789ghi..."
RFC 8785 JCS-canonical JSON string signed by the enclave. Present only when sign_with was supplied. Verify its exact UTF-8 bytes without re-stringifying.
"{\"external_customer_id\":\"acme-wallet\",\"public_key\":\"30820122300d...\"}"
Validated context fields included in signed_payload, in request order. Does not include public_key. Present only when sign_with was supplied.
external_customer_id, external_package_id, pulled_by_id, pulled_by_type, user_id, key_id, key_fingerprint